From ed6d6f90bbb4e3d77c93229ccc8fc90ff49f2a4e Mon Sep 17 00:00:00 2001 From: Alexey Zinoviev Date: Wed, 17 Sep 2025 19:51:07 +0400 Subject: [PATCH] Qfix: import tool owner permissions (#9883) Signed-off-by: Alexey Zinoviev --- server/middleware/src/private.ts | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/server/middleware/src/private.ts b/server/middleware/src/private.ts index 07cd9210ac..ee02769bc6 100644 --- a/server/middleware/src/private.ts +++ b/server/middleware/src/private.ts @@ -23,14 +23,13 @@ import core, { type FindResult, type LookupData, type MeasureContext, - type PersonUuid, type Ref, type Tx, type TxCUD, TxProcessor, systemAccountUuid, type SessionData, - type AccountUuid + AccountRole } from '@hcengineering/core' import platform, { PlatformError, Severity, Status } from '@hcengineering/platform' import { @@ -72,7 +71,11 @@ export class PrivateMiddleware extends BaseMiddleware implements Middleware { for (const tx of txes) { if (this.isTargetDomain(tx)) { const account = ctx.contextData.account - if (!account.socialIds.includes(tx.modifiedBy) && account.uuid !== systemAccountUuid) { + if ( + !account.socialIds.includes(tx.modifiedBy) && + account.uuid !== systemAccountUuid && + account.role !== AccountRole.Owner + ) { throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {})) } const modifiedByAccount = ctx.contextData.socialStringsToUsers.get(tx.modifiedBy)?.accontUuid